Data and security
churnguardian reads and acts on your billing data, never your money. Here is exactly how that works and how to undo it.
How we connect
You connect with a restricted Stripe API key that you create yourself. There is no OAuth screen, so it works in every region. We store the secret key encrypted with AES-256-GCM before it ever touches the database, and we only decrypt it to make a Stripe call on your behalf.
You keep control
What we access
The key carries only the billing permissions the features need. Nothing about payouts, balances, or funds is requested.
| Area | Why |
|---|---|
| Customers | Read the customer and attach a card update link. |
| Subscriptions | Read the plan, price, and interval, and pause or cancel when a customer chooses to. |
| Invoices | Read failed invoices and retry them. |
| Coupons | Apply the discount a customer accepts. |
| Payment methods and setup intents | Support the no-login card update page. |
| Customer portal | Open the Stripe billing portal from your account page. |
| Accounts, read | Confirm the key belongs to your account at connect time. |
We never see or store raw card numbers. Those stay inside Stripe, always.
What we store
We keep the minimum needed to run your recovery and show your numbers:
- Your account and organization details, including your branding and the encrypted Stripe key.
- Billing events we act on, such as failed payments, retries, and cancel-flow decisions, so your dashboard and audit trail stay accurate.
- A snapshot of your subscriptions, refreshed on a schedule, so the dashboard loads quickly without reading Stripe on every visit.
Your data is scoped to your organization and protected by row-level security, so only your account can read it.
How emails are sent
Recovery and dunning emails are sent from your sender alias on churnguardian.com, with replies routed to the reply-to address you set. We do not sell or share your customer data, and we do not email your customers for anything other than the recovery flow you turned on.
Revoking access
To cut churnguardian off completely, delete the restricted key in your Stripe Dashboard. Every call we make stops working immediately, and no new recovery emails or offers are created.
You can also rotate the key at any time from the account page. Rotating replaces the stored key with a new one after you paste it in. If you want your data removed, contact us at support@churnguardian.com and we will handle it.
Prefer a granular key